<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="331">
<package pkgid="7100a959f762d74e40b81a052367ab9f8cd3b6f66eb4740e3520f09eb08dd8ff" name="flightctl" arch="src">
  <version epoch="0" ver="1.0.0~main~197~g8233d72a" rel="1.20251105075527768767.main.197.g8233d72a.fc44"/>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.4.0-1" date="1738929600">- Add selinux support for console pty access</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-1" date="1743422400">- Add services sub-package for installation of containerized flightctl services</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.6.0-2" date="1743681600">- Add sos report plugin support</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.0.0~main~197~g8233d72a-1.20251105075527768767.main.197.g8233d72a" date="1762344000">- NO-ISSUE: Fix TLD in image labels (Frank A. Zdarsky)
- EDM-2459: add pprof server for runtime profiling (#1887) (Assaf Albo)
- EDM-2302: User quadlet docs (Dakota Crowder)
- EDM-2495: Add HSTS and X-Content-Type-Options headers (Avishay Traeger)
- EDM-2424: helm - preserve migration job (#1866) (Ilya)
- EDM-2250: Treat graceful HTTP shutdown correctly in metrics server (#1888) (Assaf Albo)
- NO-ISSUE: Temporarily disable backward compatibility integration tests (Avishay Traeger)
- EDM-2404: Add debug logs to snapshot restore (sserafin)
- NO-ISSUE: Remove rate limit environment variables (Avishay Traeger)
- NO-ISSUE: Add explicit enabled field for rate limiting configuration (Avishay Traeger)
- EDM-2405: Increase default rate limiting from 60/10 to 300/20 requests (Avishay Traeger)
- EDM-2378: automate flightctl edit (Eldar Weiss)
- EDM-2240: Default to YAML format when using --rendered (Celia Amador)
- EDM-2240: Fix bug lastSeen allowed for multiple devices but info not shown (Celia Amador)
- EDM-2240: Flags shown in help for 'get' commands are contextual (Celia Amador)
- EDM-2300: Services must-gather script (Dakota Crowder)
- NO-ISSUE: Use selected organization when creating new devices with agent-vm (Celia Amador)
- EDM-2739: automate new get format (Eldar Weiss)
- EDM-2233: Automation of Deny feature (Eldar Weiss)
- EDM-2168: Fix for [It] VM Agent behavior status Device status tests (Itzik Brown)
- EDM-2031: Added checking number of devices in each fleet test (Hadar Ferber)
- NO-ISSUE: add missing labels (#1861) (Ilya)
- EDM-2419: fixed meter collector to have a single label (Asaf Ben Natan)
- EDM-2412: store: return not found if checkpoint does not exist (Sam Batschelet)
- EDM-2408: Move redis config for quadlets kv service to a .conf file to prevent directory permissions issues (Dakota Crowder)
- EDM-2409: Add internal ctx key to alert exporter service (Dakota Crowder)
- EDM-2400: Fix bootc linting issue for CentOS buildinfo directories (Gal Elharar)
- EDM-2385:Redis integration test race  condition fix (amalykhi)
- EDM-1961: Enhance CLI Login error handling and Docs (Siddarth R)
- EDM-2396: Fix build source tag detection (Ben Keith)
- EDM-2387: Allow flightctl_agent_t to get status of systemd services (Ben Keith)
- NO-ISSUE: Fix commit message check for backport branches (Avishay Traeger)
- EDM-2322: Flightctl is using the Internal database when enabling the … (#1797) (Gregory Shilin)
- EDM-2354: agent: remove klog as dependency (Sam Batschelet)
- EDM-2354: device/systeminfo: improve context handling (Sam Batschelet)
- EDM-2354: packaging/greenboot: bump timeout (Sam Batschelet)
- EDM-2354: test/agent: use drop-in for system-info config (Sam Batschelet)
- EDM-2350-v2: Fix documentation to reference correct telemetery gateway export listen port (9464) for prometheus (Ori Amizur)
- NO-ISSUE: move files (JasonN3)
- EDM-2350: [documenttion] Telemetry quadlets configuration is wrong in the doc (Ori Amizur)
- EDM-2236: use require package for approve command tests (Gal Elharar)
- EDM-2351: Update doc refs from new utilty usage, accept stdin input in py yaml utility (Dakota Crowder)
- EDM-2253: Add hostname support to systeminfo and improve agent config (Gal Elharar)
- EDM-2251: remove start condition for db-migrate (#1815) (Ilya)
- NO-ISSUE: workflow disk cleanup config update (Ilya)
- EDM-2367: Separate last seen from device (Ori Amizur)
- EDM-2161: detect integration tests base (#1809) (Ilya)
- EDM-2236: Add support for space-separated approve command syntax (Gal Elharar)
- EDM-2341: flightctl-userinfo-proxy container doesn't support the Memory setting (Ori Amizur)
- EDM-1834: Agent attempts to reconcile before reboot on OS upgrade (noga-magen)
- EDM-2351: Add python utility for transforming yaml (Dakota Crowder)
- EDM-2352: improve e2e beforeEach stability (sserafin)
- EDM-1392: Add fallback for immediate /var/lib/flightctl creation (Gal Elharar)
- EDM-2214: create migration pod just once and retry without a limit (#1794) (Ilya)
- EDM-2288: remove yq dependency (Siddarth R)
- EDM-1601: Prevent Invalid Memory monitor type path fields (Gal Elharar)
- EDM-1601: Add unit tests for ResourceMonitor validation (Gal Elharar)
- EDM-1601: Prevent duplicate monitorType and invalid CPU path fields (Gal Elharar)
- EDM-1601: Add validation to prevent duplicate monitorType in fleet resources (Gal Elharar)
- NO-ISSUE: dont shutdown deployments in ACM (#1793) (Ilya)
- NO-ISSUE: fix broken link (#1796) (Ilya)
- NO-ISSUE: Fix custom-info examples in agent-vm (Celia Amador)
- NO-ISSUE: Fix git container on deploy (#1772) (Siddarth Royapally)
- EDM-2214: helm add migration wait init containers to services (#1785) (Siddarth Royapally)
- EDM-2286: Add correct selinux policy to custom-info directory (#1788) (kkyrazis)
- EDM-2259: Fix draining workloads on shutdown (#1786) (kkyrazis)
- NO-ISSUE: deploy/helm: fix doc links (Sam Batschelet)
- EMD-2207: Remove Docs and duplicate licenses from RPMs (#1781) (kkyrazis)
- Merge pull request #1779 from keitwb/rhel-build-note (Ben Keith)
- EDM-2254: Fix directory drop in reference for db/kv (Dakota Crowder)
- Add doc on how to access downstream builds (#1774) (Ben Keith)
- NO-ISSUE: Various doc fixes (Frank A. Zdarsky)
- EDM-2043: Create SSH known_hosts file during installation (#1775) (Siddarth Royapally)
- EDM-2273: device/dependency: ensure stale images are removed on version change (Sam Batschelet)
- EDM-2271: Fix TPM Activate Credential with tracing disabled (#1763) (kkyrazis)
- EDM-2255: added flightctl-restore to the rpm (Asaf Ben Natan)
- EDM-2272: device/application/podman: ensure pods are cleaned up on removal (Sam Batschelet)
- EDM-2266: Append org id param to console requests from cli and address outdated const refs (Dakota Crowder)
- EDM-1870: automation of quadlets installation in RHEL9 vm (sserafin)
- NO-ISSUE: Update repo to rpm.flightctl.io (Frank A. Zdarsky)
- EDM-2254: fixed quadlets docs, added restore version option (Asaf Ben Natan)
- EDM-1183: Encapsulate template detection logic (Gal Elharar)
- EDM-2171: Update dry run script (Siddarth R)
- EDM-2043: bypass known_hosts check for skip verification (#1602) (Siddarth Royapally)
- EDM-2036: CLI Update Flightctl completion (#1601) (Siddarth Royapally)
- EDM-2211: docs: clarify bootc image building dep (Sam Batschelet)
- EDM-2248: Replace yq dep with jq/pyyaml (Dakota Crowder)
- EDM-2246: Ensure alertmanager-proxy tag is updated from :latest when installing rpm (Dakota Crowder)
- NO-ISSUE: agent: remove stop and unnecessary locking (Sam Batschelet)
- EDM-2088: docs: revert downgrade support (Sam Batschelet)
- EDM-2232: Explicitly set device fields unset by ApplyJSONPatch (Dakota Crowder)
- NO-ISSUE: fixed race condition when stop is called before start is finished on agent (Asaf Ben Natan)
- NO-ISSUE: create clean snap and verify snapshot revert (Asaf Ben Natan)
- EDM-2224: setting awaitingReconnect annotation on ERs based on renderedVersion parameter ( new parameter) (Asaf Ben Natan)
- EDM-2169: ERs marked when restoring (Asaf Ben Natan)
- EDM-1246: Add FIPS validator (Frank A. Zdarsky)
- NO-ISSUE: Fix mismatch in RPM version calculation across builds (#1729) (#1730) (Assaf Albo)
- NO-ISSUE: agent: clarify concurrency model (Sam Batschelet)
- EDM-959: Add documentation for device observability with Telemetry Gateway and otelcol (#1695) (Assaf Albo)
- EDM-552: support for cli format (Asaf Ben Natan)
- EDM-2228: Installation fails when using an external database with sslmode verify-ca (#1716) (Gregory Shilin)
- Bump tj-actions/changed-files from 44 to 46 in /.github/workflows (dependabot[bot])
- EDM-1183: Add comprehensive unit tests for template OCI image validation (Gal Elharar)
- EDM-1183: Enhance OCI image reference validation to support template parameters (Gal Elharar)
- EDM-1392: Remove test containerfiles (Gal Elharar)
- EDM-1392: Fix bootc linting issue with tmpfiles.d configuration (Gal Elharar)</changelog>
</package>
<package pkgid="6b9a6924c600915fd07045d857f5a9dc98d74f7043c8a5db509bb0f355e4621a" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d9a9ccecb77e7bb338d6595bc1368f8a8e1b3dd3d0817af67f4b1188b1895763" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="69843b85f0c2f4c002c3143dff3c76816709504c593edefb1457dc684537d951" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0eeee31a745025cc1cf1486533da24ab53393c041f4952840a92a55927e9a83c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cc1c4bc22fa51366e9f3bfd284401e77d2545ef4868d0896cc32169c3cd5dc44" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="21c0f466b4a0ef9c3ba8a5accd25058aaa4dcef253392afb44fa122ff4eb152e" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4235c5797c6ee4b52fd1f70cf0960aa3274f5d4d3eff3e56b64b6a14d66ab5d9" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9dc18e28e8c289df2d94bf15dc1577b6d4f455de46a5e9aa9b72b250a5e85dba" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="780eafb460343756b5b42951612279d099ebd0ad0f4102b2daa3d09bbc1a981d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="af87f030516e2d837d8f44b806d54b197a63c16b67c78eaffce37e5af044fe0d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a1375a8a91f7bfd4114bc0c105e62475723177d3285e6085a534c94ee59fffef" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e24f8352d441a4f2b3c175d4a70468905afd7df7c05f4e578601a1fc490ade97" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1f1290c78352b1ef77cdc0178150cb3f7d4e5c0ef6b4084005fd658560c31144" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d29b3a0559fff56c37acae0318ab9e366d81d4e05fca467bec9d117c51a8c122" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4b9c774d9282d80c13d4f59fdc0515bc312c4f028b5c453648e23f47e80482ac" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f1831110fe2a5828a049442c09bdc9f8ec5eaf3bb84d35510a02c2646fdd0e3d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9e9bdb2383243a3e19f42de25e4206462efeb57731bbcf66967efcf4a5f7750a" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e52de7f94e8809292dac2a63ee401143d98ef4bf95049d56c066fa07afbff081" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9a9a3d376ec0c8e0f5a8fa6c56877832acf487c9e4a299bf6bcb2d8047df2bd0" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="aec695a825e374a3288c4c9f71bea50396953aab5a6fb26ee69b893f020e170e" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a3624b007cd0608b9cecaac5d65f8bfb8cd581b9efbd434ea377bf949d89af11" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eb0bd945183d4e5505e1b003fe43d8302f2b2e92a9be62bc78aa6f68768162ea" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5eea05c320c24aa138e5a23fa941721aa463947ed426cdcb2785f36029de552e" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="82ca826e7a277dd5110d92537bcc6374b082c425bf9c4f56ed7b597a7ccd249a" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7005848d3162fb1ef6487271d19aeb101687979444a0f88f01ec07a4ed857c03" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="16595073b1cb42e9a586acd8ae61d80304b6e464cab1656fc7a5442d1a9d80d3" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fc2d25d260716b25b73bfba4236e9f407fdf008566adf0f0d4e826d401d36446" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b2b4cb1b8de8445415801259f56a0d33f31e254cab9ce632f96949d3a0a0d33b" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cdc31fd39bb6167e4bbc69b214fb3ebc488104f289e86e06175e67ecd79d3ba5" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="befdb93631849ee856024d6d6283e5e34b986ac30ee649ccdc2db6f069250aaa" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e4cf32b0bd380e4b396645b04b9b6a7baa4ca7e0175bc8831fd4c17bb6baaeed" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7df0962b8147c0ac3ae46a5c077384c88090644f2506d0451dc7361db757cbdc" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="93305763ee1d6db552d2928fd31b865e5c2965fe103699b22e27cd060f84709c" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9bc31ad6374d34ab7f21fe340496015f1ec62a51fba11f2ed8cbd6117b372c7d" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0ab0bae04ed3229cbea72bc3d6e49a9265647969e53c95cc1a0bc0da0f53ec69" name="flightctl" arch="src">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0f72b769b7484426762da9a7570a87ab4d9557e8832f3ee59b9bee26e76e5337" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0f6b1bc6589de315c5d8b80a1537fbc629c6a51e3a4270a3ce7ddf39a6655b4d" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="29501cafd1ee3b9c2f6b12b83dacb175b2ffdf28fd61e32d681295cbfdd817a7" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1a13d25177d6ad2618746d427977ac7b912f5545c1399594c57c67b743a01917" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3d1be9be5a164423445a26244f5a1ed6941d15c31e12dd68d9ff6313132f946a" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6f0223fa239a1ebf6f9943621249d65b1449973d2e7f8c0dcda73aca09e02555" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c8d7c755f617f18da0cdc41d869d97b150668127585fcaa03fc1bd09dd8b1a07" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="31908ccd45c5d321d8447c12fa389d5d0acd701acc0c003ff4cc1444296af54d" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bfb89e1918321d8dbbd42154a2ccf5507bf2abcda5095aee9f84caa6fb8f8565" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e8597ac8c8b34f362917eaba206f33bca632f576a46cd7068e4acd6ad8d7b92b" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1b64adc7eeeb6ba105e2db6ddaaea8827561dea1019e93f912825cd5ece3cd63" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0f92b4de2e87966507a5bfabd0b209dbd7350203292a21ea918020f60d06b571" name="flightctl" arch="src">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b38d5a2c2aaed45d91736a3b49ded946e92cc70ba5d4d96ad0ca5691e5dea1c9" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="59fca7b477a1da9125fd32b6ea4447b8c3bf6547db25d166400337a00e0ab6e7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4af820da26e2c87b412d709eba9ea21791bbd750cf59a887bdad53dc09802237" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9dfb6f810c11319a6349726dc4a7eca4f20f6957588e25e5e19ae5d7db8d34bb" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b1162b64d281d2a34674681ae0f406500f7858f69bb87f729e4e1084c0b8057a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f2ddd0db3155725d2d595609a4eb4d76842c003b6d476c8e7ea31596eeeb1c9f" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1dfe1f574e08ac9cf3c9271f26ce8e0e17df2c5bcf2f9757f7d8d1912d32e10f" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="962906b6f0429e9eddcda5999c8d84b4a1e053672f31903e3cf0131987db8892" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fdf797316edb1c02c5c97605135a39fe89371a4a85439152a337ff4b228a29c7" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c05b0cf1dbc7807da0072a1e8cfb13228e171dff3ca975a355c8fb83287921aa" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="80af1350bb866e3b37d739d9bbf855f718b574f42bd815b438d9427065609efd" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a51cc92a360f4eead285b9dc20d6f4c7298c1b5794994db1407ac486c82c625d" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1bebdba5e3ac304929fe675c02a692f08af8988009f2e3e5d7d7bfaa804fd000" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3e9644c69e14acec425c477de22ef4cb64e58e0d26f76b637b50d0211d6e798f" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9bd549469d0d28ee9bf74bcd7589912d6bcbb134d4f6c0d869c06fad102dd829" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0535be932f0277a71a145fdb5de7e1cb08ff22d9950e30eccda3e14d4a6fe51b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f59b931737d630327c67392a54080dec3e8e70654a3d357bb9c1a8fdcc41688f" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="81b9f6b3831a2685fe179c3fd3cd3acc5a849aacd5538001912dd73e93c50dfc" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9ca634e6b42d4f44a0b3b5ff7a7f10fb44f908c68ff56cff4da15c26c6814283" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e765f4cf14ea71884a797f7cb8da4c312218bf404ab4445506b6ec9963dbb4fa" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2102486f457b59bf072bdde02d526a6a055830fc0c99ad33498145abda87017f" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d7246ec776886f21cef4914950dc6c808769e792191de636a2ccfa900cb1504b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="158368571a9be22cd932cdfcdf84d47bd91be363fd733f3cf136a3b32aa20147" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f9f11a53e2d614b3080131fa023f50bc3df489791de1fd93b402257ebcc35587" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a47fcbefde6e9dfa8803e5d7bcd12006c7dc2ff45fa34df3f2d5f136b3df770b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6acc2ad047578373fbe5c27855ef5b9001cf45f855ed07f68c2144002434e9a4" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b7a55de5594ff9615e38d1942b2d14a6db294d918f5b4c561aec847e728e1dc4" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fe4ad6602756eb0cbe257a88d037cd432b37a4354f2b7f0c151ff1595a786979" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9f104aa3e9a0f2e1e8cfc5a0ba925934fb481a4cf1fa09c1cfc254fa4d8d61f2" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="41e8f1a711f02e13751a97ffdafbc3492c4e0fe673679f4137f1ce2ee131f77a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="57f5e7dc00f86c4d46e87e3e5c24d25de719bf7b0b8c9af2fdeddeea1855d644" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="47f763ca5107fd4ab5a7589d907caf506808e80084e99d0ed936de93abf8ad9b" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9bb87bfac0dfd021820a42cb778370f6e43093d56e11b77382f376dcdbb869d6" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8719a46142acaad47fc9e29aab8c10dbddc2dadee418bf7034bdb13aab4b8b91" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="208f4efd8136fe5d9ac80d6ba3275ef12109313028eaa6b410043313884b8381" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6f8bb085345c47c41a1dfa83efc6f4fb896bbb969f062e93e7818efd252c3a38" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1074c218983bedc2d62d7d082d6a57344164076d99e3f3d4505d1933aefe51fb" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c9f2a678c72153d22b95c31c9dd4540f45103547abd1fabe5123f686c484addd" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b25760cdc4f872a72be74161328f31ca3cdd82117d4b45886c603197436d8a07" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6a61fd3f227f330a99e6ff598ca3cfcb06d1599989d5fafa4c0e827325b148ea" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="be75dd1353f0df2db14d47a34d59758e33b53a46da732e369fc13e59e3817076" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2af29f8c1362a1e8f1626d6d24051ac33e100b4692416f962c991e5961a9bc92" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9da2ab199ea2e19eb8e92ca98c86d8ab2cf60b938224ee7e7f2780d434bc58d1" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="16847af8e69312b6cedbe728493fd0afca7171d6492202a8fb459d88f4db02e6" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="f38ff95531198fd2e7ed915639e9afbd87a7d81b5f896d76c9a02a8a1b00ef18" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="2139839930e758aaa3d3263db35e791b133ceac96936891a9b840c12eaf08c0a" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="29e78ad35f590e741bff69adc30d9c75ace2c3a32b3c4d23a4081d4238cb70fd" name="flightctl-agent" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e6d3ac99f73232fdefdb4a987092306b8504b1e0a9f0143b7c6e8ae61777ef8a" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fd4be66ce98841c7306b3d41f396b07c9796b4cf4d2ee05f6378cd2a565382de" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0ff43983916201000a822e611de167b01c29304375d1409187599f98d920b371" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2b14e215b58ebebc9d51e8868350af981a3f1e5c30bec49a5efc00f8f7e907f6" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f10ab81110a34a9688a94b31e9b40405ad54351b6b4973757a2e038e4aab8f85" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4388ec98b9514f2bd503b16c03f1cd2172d6c1061633cb6baae50de30d1473e0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0446302362f089e07fa21d9b925de6c7fc16332bcf5427609531b157ab8a9e46" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8c3c1654ba7b62c5acbef6a82ebbde19287742f87311c6c14afcf0004bf533ab" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d3f58ffd540649e0280885a3aa3e4fb2e536745e091902d2994514ff142c4e61" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1fcae535a73f7614de843358219155fb185cdbc64bb9f04a412002ae21ba7498" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fa99c632d3a194b1484042711c972ea920da358d99875cbaed5e63e9889f6810" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3d0e91cfd0f8d977ba2a89912ba50d32768393862b686875f345dd707a0e905b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ff13137f8ee138d3ca605f507862e7e9591fd706de50abeb4ece5cc592219877" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="341b47de8fb299c8c99dc6bafdfd55b69cd9932860fa054faf30f6e8c97b458b" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="08dc1d9a84fe55d8138f50273a0bdbbe5e741b4a96430507063f5bdbaf92ca7e" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="096749348906608fd9a8f201613bd515d598f328b2bb4242db9b625ccf761483" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b081a222f122b0c4aa6597ddbdf8cc8186ca471d3d7b21847ff2fa2ccfe38f7c" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="40499f103af22f56b7f12d80b0b8fb2626591aa54da9d08376ddde546ee0f507" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8def404025d8a68a88dcb2ecf01f931470b2076590d196f84184ce2783f921b2" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d03389366375453dd8634fd84e5353ab6d32fec2db7a6a1de57f5cbfa7295af9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2aef497ab008d0f01c59d18f09cb385be45a8527b011c15922b76ea3f9b760b5" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="132bd2fee5cc95d87514ec7af45d4bfb43c3aefa0a2caa7af00e3bde8528b65d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f4379b12329bc8d65d04e338210b8e19aea5116a0c54591a8c3238989ba5d698" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eeb4207c072ae25ce661de46b0ade14e9f0e60bdaca1d30e7c595e75ac8b36e8" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="32e95519d5b28915534a3fa8c05ed825a69673c8a33d4ff7a6308485a717d191" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a83d5a3a10aa0178ff42db20243b311ae78874c028ed11620992ca119f2caaba" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2e25675dd717ebbefd3df7484827275fab5ae171b949cce632acd948f37215ca" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="889dab4dd909aea1df484e333f6ff9bde86587723d0360ed59630f35a4d16a2f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="07164cab8cd59f9f0b2de55d3c4967f7a9ea3a5d8cf664510918e762c4f43779" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4e88f1d0267b82f92decf8ae351a1ad6d85585dbb32cf2d1145ba4498a1128e5" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7b7445304e8f7c938b75dc8cbf6d15c1f6ac15125e3588412f8111a51c1b48a9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ae391f66a2bbecec26b4a252d59a5d49ce9b20fb598a8bcd289248c840160d46" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="890ec4a8b7244bb8dda665a66720f2b1d596687c8a8e4602aba78f589cfe836f" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ac7890866529bc6c8b869bf83f8b048b3c3e704f3fe4bca5da7a7ad1a3712423" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d6b8d70b0a7b999f2cb955e1c737e46dfd6fbdcd586368ced22f77c5891751a0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f4f8ec14db84ca8dcfde6f527f00f7338395eda17e9e270af0da0ea96e8a98a0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="23b5d2d8250a00e93fb4256263edfc666d848d13ba8204df24da899b0e7afe25" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3beb33b39253d84b8e4ffb4b9454e607f01e6d34328d3cb3cad772c4b854757d" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="313b06445ed4f6b15d8edbad4d48be163ded89d85da595e23f70f56ee9cf53eb" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="36972a8a0344f3a1ca4a0bdf522939611bcab61533b579242065fef3ccacfec9" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="d3885ea97ff51aaa3582603b1fc46a5a276357c4169ec7d52277624dae90ecf7" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6bbaddffc399d97d81ebfeff566b78c38c038ccadf3dc5560cd20b6ada4048fb" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1b8573f49074ec463a991a2c11ccec4e642df199569eac9a85d2374e18444eb8" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="782c136ef227db2305218812c35199795a3465ccef1913de4ce96c54dd1095fc" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="85fee31783352309ef81ecd5dc59595d36f2c325b155ecec2516594c5f8c6073" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6bda29fddfe0badd81bc65b5147e6f627c8793c2af1351c6698def97fb87aba0" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="9388ccd8e338b8e04d4514cc2371168382f269be3d2ac7ff25730f8f1a670101" name="flightctl-cli" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8bdc6626e65d4e23071bc90f5be16001abd672684316bb06cee4fbebbae2f47a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8497be71e9ea9c8498e883749fd5f50adc1f65942621f83fdbe67aa99611998b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e828fd83507dbc3fba6d0892e0d9a1ccd6f0603f957bb0e14e51050bfaddcec6" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6b8e9cb2ed3f1c15456dc4ba95b2a01a3dd7f95a5d236d20443333519b6d8918" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c32a84108ed039471c619b37af4764bf19579de507e22b9374533a2f3fe79c7f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a9510e3b879f01d0dc7522d20efa668889f4604a2a833382397b789a97908f44" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ae83b4359f1f5401ab63506ba8287a5c2079d29903f62e549690bf8240910392" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="17b69aa6e4e544dda967030a08dfa38fb20f00086e3f688b7edf6ff740e779fc" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8c453c763d9fbd5730b6232a0899024e34e529201475285134e27c5adcae620f" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fc12711149049b5e407268a2259532aae12bd0658b1446776e2e11057663fed0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3cb7aeee0147e9c183a627c3f4917bc589d85a1a929cad678c901235b79d5c46" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5e4d6b6c28460ea5b645d6891f945f247752a766e0dccc05674f80bcf117da5e" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="00b9c89215993f8a323656ce7f1f42994a5505ac9536dc89fb68bd004447f4e0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="384db67180aef3415af37bcde6e8b7c98673ca0ca9a7c6dbe62f7b733b441cb9" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ba1dae0ef1ab75510fb1955f7a789dca51e9ecd1bee64a33b16c16cdb3183c0a" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a96d3c66163e9abecbc77e3b2c4e1bdbb5b2fefcd41ad988e9de6e623291a81b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2d73fd7a719b6a469eea539a25ce880fd3311e8d8ac7418e570524c4dfa0e634" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0aef05cf09fba877d875977db03e9a15a780cd891eb95e51bf11d2c05ce42876" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f0f3074befdf03326cf8ab8ced49e62b82825f4c88ff36efbf6daf9c5bd024d0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5965bd012357681f68b6daa88bc70421bc5dd9d4a14cefba2d63a483dd2b34ba" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a57bc442d8350271a22ac02ae4555c38e997e47b26d55d3b27bd076d7f907396" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e41c6c6327d41e78fa0a82d090b25f28f2a211c6009a228752b509776fef4e8b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="40aeb318c6d8f8ea42d35581745bc611e778b1456e3ac90e99e5bc58d6459c79" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3a89708ee4ae9d8d2b96cd1e1d456985669b56b47479a1a1e122a18a6a23ea96" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d2417a14a59937b30619cd2f643531aa1c691ba4d28c82a6228248df1dcef329" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d1d7e0058216c9f4046d4cf64a013a0e73a1beb142b299e38f3398dd1b821bb9" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0d14daf2963973f6c1ce4dfd7f1a9bf92dd69d84eeecbda4f13888bd46d17b36" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f5fe984b27a904dff8eb28731fe7d7e6e24843d9f13ffc72b6a16d5f25925809" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f61c82f9e8148f7e70a4461504561b1b628d5db61d47ee11ca330d4307e05db6" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e865714707581b7c44e58c25c86faf8d49f44e21e61a817c476f5f81f334107d" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d6c2cef47d33a8bfb6e540d2f87538adcd81a16f9b2043b913920edcca7a32b6" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8c39afa6e76fac6082e147661649d0fdf8f06fb763883ce522492de7556c0f85" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2b52b551f8fd4b97d68c8f7d29104594d7890f54cae4cba66dfabf03ce45bc3b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e28fb286c84fa48cfecd6adc8d604dcb321a85b4ec40b4d1471a20ec30c397ae" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6fda5fc6952d280a8cdab7a26a9ae5bd2c1f41f595e9a33eea9746b52f6681f0" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="72ae4d5195ad48289159b00bd44bc0f8b5bff656a73fcb0b69afe0d7e4aba256" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6562c414ddb53c76b5b6e9e99934534d5d64839d8285f97c7b60d2f6ad47d3c1" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="314bad2ce2536cb49072a07ebf6e2aacf2aab0a8da099c1cd1a904cc7249035b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="47ab77ec5bd936d6731c59c7a58b39f1e287fa460553db8845cad664a1ce474b" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b571eb0e967041b779cd3d88c3a3a65b603ba0c8c96730912374af737210a3d8" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3048ecbc53ae1fcd24537e135ad9d26316207fb682343191c2ab528455eb87d4" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0d95f81fed34222320b1b151a120f95978e5a1ac824bdfa08d34de525e21eee6" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="8433d378617797e2726055d8171a06b715c08e7e6e3ad6474946067981473378" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bccea0145b80c2313163994a32892599152ae682d619c57ceb1e609d3d7d9fae" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="520f26523b96d188ffd66c24aafd0b5a0256be41519db20a6ea7d38e9487ade6" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a4a8d452d6643fbb24b121b338db1809e3494eda146cb698f925e88d53b029b3" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e1e10846c81504a0d53d2c031e2c2e5148075e50cfaff59e7034fcf6786a0da3" name="flightctl-greenboot" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="af31fd42d1bf54f8e55ec16ebe592a3ec2906271b42bb26970beaa2438df38c4" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a423f87de574526dd35e0a02cd58a9b2d80b9932b8d73911ef1b64584b56dfee" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="90855b7ae73b733c7d342e3ac81e064b0f87913691ff6988f9092e939884f1a0" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b6a5bc2ff7b1d6a831cf0dbf9a2f31d5e26a35f9c7e1ad4161ea96bdbfeaf8df" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a0e4472fb1fa956344f628ed06f32a4c0f2bdb51c001f65f2f031fa4636803f8" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7805ff691f964918ec6b9265424db35d4cd8792f903007de996ed552dfbb7977" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="11e6a41a11514c58d605e5ac8e61cb154b39b7ccc97640cb16d299e8d55fb575" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="72c871507ca5bc3d8c028951b421fff3bb5a739a96c2b82297d58694252f6063" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="654a677ecbc20a9ce7eecd9d8ee5b0138f5b8003562b3cae8da931638e8f3000" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a975f59d72273b40117e18602fbd8e465e096e8dd447d82908d6fcaee46544e7" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9be6c81eef2129d183dddb8bc9e1791897306bec4fd9aff9119210e1b05ef26d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8f232f8d52d4fd8aa0e3714ae5d421b17f199ba7bba29f7b6afdb5bce68cddba" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1cf48c03f07eda3c9bcf2ac393d8ffeddfdfbc528e435cad806bd7cce69be920" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2459b11f31ace62ecbde81cfd91b2470126c521ca9c5f6f0bdf9e50ffad2db4d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b31f11236e21e8eb67688b3b9977e791bc5d0caf5399186cdf1990a1d7de5757" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fa07db8ac9818ceca62f42ea49f9e8bed40097eaf289621196a9919430e80ccc" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3c1ef28ec684afead2fccc94cdc00f8c0241f805f4bfa2066db34f3c052fed6c" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7dfa1e5e201ad3413e82399727c653c97748b243e981a1b822dad712a051157e" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="12cf51869b653969c0bb55f1b929d76bb1d6186f30a1fcecbc6fa6feb35b8443" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="31cf697f82d73da4474f8e70cc50a01322384c1d9a4b620bd3af1ce5f07c46af" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d6525c864c46294e44901131650c4ac3ea7e9240bdd1ca9a6087b3dee76a9a5c" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="bb0706697d5dd4e3e110a7784b2035a351a2c9277affdda7181f6c1e2fba4aac" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e58f9cdc18adb01d0fe69e508a7d8224a0e6a02be7f907fefaa4c3a279871ffa" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a768ddb816495df81933900e11daf58cc6852703b0bbd178010fbfe974f87a61" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b89b289ba11e536da4ad35ac21c1db6a248ece69bb3516dcb84cfefb3191cd2a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f2dbfae55d67ac746de19588c8eac16817cbfb840a8deed0e2def49d500801c2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ea1b6c2ffc9369a22a11ecdafb10c842123411ac2060306077f994febcf52811" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ee61316eed4f7cd5735d722388a6da5bd99d72b715f08483cf449e1cde3c6494" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e08a462d29af94f4dcd8ce3adaf8744d92f585b1e85635017b598aea9bdd0b39" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="81b50138593e0d1dd9a38e13960d9f5ec443d4afe188e926d63a7f8c7f8195e2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d8072f13a8fdc0113bee83b4969f4d5d0d8f7f59dfcfbd4ead99d2d9cbb9b563" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c919aad708961e9d91a8009ac5802b57e5fdeb56e4ca93e9c8e29bef4f2a242d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="97022a5a1ece9b2e10fffd2f6858fe6cbaa3d354c114c8f51a72120f2a5ec7d2" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b3c8197e459cf9a8c1df753d95dd82fa5da757dc4d0ba917d464057ff2d744a5" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d2d712326554c96186002531361d687d2988ac806e289706091707ca91e165be" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f60e4af6043881a448145d569ea5d19c22c633d7845ed14bd2796a4d6ddb6a3d" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6ed78b28462b5f51a81bca2a3e8953565e1af3c936c1a47eba51aa432dfeb030" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="4fd3fc754bfc05ab29d8e03684d0f1b3f3f4fd27739fafbafc074b942a3b9de8" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3e56382f52c098da197d91c4bd7fb63dd57490050d02954542dc540d694c6432" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="3991b14401fc9e9708d0297a086f40bedb4c7b9c8b92396c623396972f8cf05a" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="922ea4677251bb332eb506bced7137036d60b38e34e445a4eac574bb1e420bb9" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="caf0c732eb81037bc605eeaf795754a3df25351d9f65ed11cc7e220cee576a83" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="efc8df282dc03b4a389c9f58c0da8925c8ace1097f3cb2a2445049bb0fd429bc" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bcdd62209e30380b7f13b1b0093708ccca983211107d3152ecccb04152329770" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="49b48075212b2c75d8e9fb6d9ea67b4be139b17fe123f8b99ad42f79b5a292c5" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="e4fe3fb6e5910612803db78fc9bea5f2c68d7e39b4d223ae51b13d5cfbf8a325" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="57c15bd42dba1b46724c0c18a03c1fe0694d3741118274a78fa691649d04933b" name="flightctl-observability" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="33f0ef87517a552dd2f86c2a394fb44fa255cf2e9c94094a54cd5091739c089b" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2ea5ddd05ba1f4eb9e08c0459e2ac3aff1fbc51a401fc75ab337fb11f534efde" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d96ee36eae5ba7bbba21253beb6dcdcd2e0fe46cf6874a06fa5ca6260f9fb30e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="677e2c6b41aa566e3da1da846afc1e928d4418488dc6fb458cb8d14c77d4e86e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b84eea44068ec9f00e4d965e6c6fa899d95077900e359cd041a4d7e0f47c3262" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="9be76417d8791930ae7926350b8e5e1e3bc8210df7cd16faaa6125e21665b0be" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="eec579706b06a5a3e0faba4d2e47aa4e13e127beaa1da2641f28868c6385af82" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="66dfa04465eeba379a62e92d2c15175821288595e3cf22bddda2b55e1a5e978f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ad5abb7abb743672ab3a99c9cc7ad209d3074f121fa2b0239fb927d2fa6ec125" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="91adc4eb1d7e7fe983bffdbffd72046fda9a9bd7a6b23453e80e56fe76163f22" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="917b77628b6d2dede8f3874604d19f60ba1102eddbdac90abbf1f3c72dfb5478" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="084625ca6f306df1a4baadc86600a9faf746cdb08918aa1a6f10ab4be918b9e8" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="09263e5ce9217d278684f176bbd47e16e9f8eb3951640345c58ed659b1948a63" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="4a3aa18afb122b08c0c5b5a0a04247b5438a5ed5ee304fc2a94eeb2b3d5d8d71" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1a84ada73ce93d7169d19f8f25f4ef5f06da144e947f8a8be9f0183d44d68786" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7de28f6612a5a67c44ea7e32b0dcdca040d2310da7fddc0056840ed8aec21a58" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="36c5b8ff9ff7dccdc97ef0b8ee039540a54974d059a2b8c5a43b6d4db906f75e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3adc931e5b32c7a351fe6f3867f4c5c8c05884538e8eee1b2cf0faa7855eba14" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e795b79dd7c37e3dc8294edf27c6fd8738d094c038c6b2045e4d66dd3b7456ea" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="3ddff4735381c3ec3d24aa8293fd3209acdb77e1264089cac0314f78523f928e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="81ce61565340130b7e1297904939ac0512396a5bd84ac50289e8455cb6e9d854" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="57d47a6ebbea24a3947fe0b37760277af5e36e6d3ce742c665b9b24dc146afa9" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="0d2696d2efaee023bbd1e0933d7407199cd739b296e0c8469cca094aa0ccaa27" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="cd1362a976cf5ef0dfb12b3909f892803fafea46aa421552c2f8497cd7d77194" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="451a5fc4d575e59f3ddd56e2b988981d28f9e789f21da46cdc20402edd6690c6" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="97ed2c3ded9339726433719cd8800b013743ff161d915f3295ad070910da742a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2632a1abbd18b8494ede5da1fde1e0cbbff02df07c272458a67d837665ae33a0" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="741cda91bfd3afaa84fdd4bcad7dde227ffb1f31df60b139eacae549d220c555" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="684d3f296bccd944f86853652388356543f571d93ec950b65028339242a5e69f" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2796833b2b9eaffac2540b85379a282f6f8ffd562ad82368192031acc6f18b73" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6304a7e9aa1a41c4d359200b086784cfa9e5856f4a89353805bf22b72f2dc89c" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a2942aeddb92c7ea2248f26dcaab0c3fc98359ca5862d8bfcf022bbed2fd4bba" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1d789010e2c29e6fba82e602e706cdd5134b5fa1867746bc3f0632875e09d37c" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="13068de5d3576611b1929c823aa974f8ff5428710a8fdf6e20c612764276278a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c8ee7697cede213fb0911013d6776e15409db583d5e0ceef34aa7a5b8f4140cc" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b892f0ca8acf10912770b4783f832cc8f3176dcb6579c0a3dfe535aef68132bb" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="37547f482702830386966cebc9c023aba498b93c40a859144808e86dcdb02236" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="983d01dfd13743f5d92bde7bff823ef825a38f040efbe7e6ae00ba404b6b0af2" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="43974c651fef70f40dacb3cadef591a285bb8a0eee569bf6d2d7fe893a6289ea" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5f52abc4d5208174617c7a89c9f4da96cf40d25e716289f3caa26ed1e041b3f9" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="5f709ecf99e83d60cb66f7b9bdd8d27eb0c34bf5984b1b5968ffb03159e70fb7" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ba30e6361f674c51014f486a36dc5b290ebb57109a35a4e181a3f916ecf9fd9e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="33f4ff0411049e99f37237ee3218e723bdecba0c30c3f81ac616ac03ec9bb836" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="0586ca0d478b5821885ef001dd26b1567658f90f6552a6ff4965407b4eda1694" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="ee5e52c882b58ed7092884f51988b6bd2c3221544ae3a3096ef1af2e1ee7456a" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="96895c0906cb1be1d4d1a94e7dfa6b884f4011e841355769fd7d418ec49c8b4e" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a1e21a60ed9d70e92ac792d6658decc7314041130608a16868c0bc2dc09bb030" name="flightctl-selinux" arch="noarch">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a5452929648e50f2947a7455237b847b98f19121051ab633d13326c74750ecc1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~347~gb7633e3a" rel="1.20260728082515259213.main.347.gb7633e3a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~347~gb7633e3a-1.20260728082515259213.main.347.gb7633e3a" date="1785240000">- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="991b749462bf86cbb7e5fab8b367425a0cb1355277b7d93e92c6611bd7f940d5" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~350~g1f521943" rel="1.20260728121655345466.main.350.g1f521943.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~350~g1f521943-1.20260728121655345466.main.350.g1f521943" date="1785240000">- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="5563ee72724b465a39a25d18ae3c6e32c5507817c470580e3629b1d88204c022" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~351~g2767f78e" rel="1.20260728150628600345.main.351.g2767f78e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~351~g2767f78e-1.20260728150628600345.main.351.g2767f78e" date="1785240000">- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ae651ed7dd3b10fca543560056c02ec1cf9ca88a498506ea09943f1c361b5d13" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~352~g104d1eea" rel="1.20260729072402642435.main.352.g104d1eea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~352~g104d1eea-1.20260729072402642435.main.352.g104d1eea" date="1785326400">- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="28686a3a95a4ad6a68412bf5604b077433d652d30356d4c300e7ac11d3051348" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~353~g3bb4333e" rel="1.20260729082825991127.main.353.g3bb4333e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~353~g3bb4333e-1.20260729082825991127.main.353.g3bb4333e" date="1785326400">- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2b97baafaefba561e7e50409dd5b1aff864f860174b344c7c7f640c7d0847c84" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~354~g2b770412" rel="1.20260729092724915568.main.354.g2b770412.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~354~g2b770412-1.20260729092724915568.main.354.g2b770412" date="1785326400">- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="878824816e663f3d040d666db4152d4149c3e869a2e860d306e102a9b1f2c0f3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~355~gfe1f1964" rel="1.20260729100631325453.main.355.gfe1f1964.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~355~gfe1f1964-1.20260729100631325453.main.355.gfe1f1964" date="1785326400">- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="e3c3d15528608d147ad54708714687790607cbefe0e3cf28c028f532819db996" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~356~g9e265338" rel="1.20260729115712764036.main.356.g9e265338.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~356~g9e265338-1.20260729115712764036.main.356.g9e265338" date="1785326400">- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="90558e169118ec408675794faeed7dff3dc704f382cd0af051766026c6fa636a" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~357~gac693f6d" rel="1.20260729132300377006.main.357.gac693f6d.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~357~gac693f6d-1.20260729132300377006.main.357.gac693f6d" date="1785326400">- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a22cd901b4d1b8e5cbbde67a2b274e31380d22bc8d3e99ea6481e882538a230f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~358~g09621aae" rel="1.20260730144842828330.main.358.g09621aae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~358~g09621aae-1.20260730144842828330.main.358.g09621aae" date="1785412800">- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="6425be48bff3a0c156e242167a2ab69a3900e4a91a5b35a1ccb56d8ccafda4dd" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~359~g5b12141b" rel="1.20260730162108817275.main.359.g5b12141b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~359~g5b12141b-1.20260730162108817275.main.359.g5b12141b" date="1785412800">- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a3ad4694fbd3f923dd447a927aa82c28adc69d6eeb8859404c47eea23001dae1" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~360~gd6faff06" rel="1.20260730181739938733.main.360.gd6faff06.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~360~gd6faff06-1.20260730181739938733.main.360.gd6faff06" date="1785412800">- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="405dc207d9ce9f607a67888df83dc9bd402c57711064aa54269156017fbaeb0f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~361~g0c1ca714" rel="1.20260731114259039753.main.361.g0c1ca714.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~361~g0c1ca714-1.20260731114259039753.main.361.g0c1ca714" date="1785499200">- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="b5d6bfd83efea5897d133129d616a87016cc503a050e295ffb0b3bb8219d381e" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~362~g94efd3da" rel="1.20260802081024493192.main.362.g94efd3da.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~362~g94efd3da-1.20260802081024493192.main.362.g94efd3da" date="1785672000">- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="81eb5a4b2441dc02b7fc85771cd7f0b0c41cc2dd042886fd2e3c4a336799009e" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~364~gc7e40afb" rel="1.20260802094500372050.main.364.gc7e40afb.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~364~gc7e40afb-1.20260802094500372050.main.364.gc7e40afb" date="1785672000">- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a11cb92ec2c720b504f46b62547f1a5a418f99ba05701806493ebf3ba9a1c8a2" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~365~g26abf0c5" rel="1.20260802095329029092.main.365.g26abf0c5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~365~g26abf0c5-1.20260802095329029092.main.365.g26abf0c5" date="1785672000">- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="2e9cb82d0d878bb69a2281918d6fe40484c5417ec48da9f72348b5b56ad7c29c" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~366~gddc5a96b" rel="1.20260802095914026187.main.366.gddc5a96b.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~366~gddc5a96b-1.20260802095914026187.main.366.gddc5a96b" date="1785672000">- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="1d8e63df493e432a79e0fa6b02edd1ad496583c0045bd405033bda6b76513c74" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~367~g87e3b509" rel="1.20260802130509870733.main.367.g87e3b509.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~367~g87e3b509-1.20260802130509870733.main.367.g87e3b509" date="1785672000">- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="ca1c1ca8146cfec3e0b74933182e78bfaafb722a35b9f167f6c973568a1703ab" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~368~g332ec1f6" rel="1.20260802194846072056.main.368.g332ec1f6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~368~g332ec1f6-1.20260802194846072056.main.368.g332ec1f6" date="1785672000">- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="8186af224daa77ab712db101cc2e7ce603602e6ea3af63bbd8f2c9606f80efef" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~369~g10195d40" rel="1.20260802222629379693.main.369.g10195d40.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~369~g10195d40-1.20260802222629379693.main.369.g10195d40" date="1785672000">- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="30c59eea805a33cb392a0916b68279ba7ea6c59740fe27192d54c7d6e0c41698" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~370~g8d6a0175" rel="1.20260803064915217842.main.370.g8d6a0175.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~370~g8d6a0175-1.20260803064915217842.main.370.g8d6a0175" date="1785758400">- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="90a2ce8ce2e00a24ad9fcad4d848aeee92c89f5a3093520c491b73864fcdba9f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~371~g4b4756c6" rel="1.20260803080246501316.main.371.g4b4756c6.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~371~g4b4756c6-1.20260803080246501316.main.371.g4b4756c6" date="1785758400">- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="d27c5beb0656c737bfd6c7772904aad0fb828d9733d363547838066a1de018b9" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~372~gbeadedc4" rel="1.20260803115217288710.main.372.gbeadedc4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~372~gbeadedc4-1.20260803115217288710.main.372.gbeadedc4" date="1785758400">- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="86ffcadc5699eae3e0bb9558ffdf8657d59fd49adbc323ca4d1a670c4bf32169" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~373~gf161e8e5" rel="1.20260803125003642867.main.373.gf161e8e5.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~373~gf161e8e5-1.20260803125003642867.main.373.gf161e8e5" date="1785758400">- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="c16df98f3a08af339cd673da1d5fba69074837975ea1530206eae990fa9011a6" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~374~ga83a1a78" rel="1.20260803150753946755.main.374.ga83a1a78.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~374~ga83a1a78-1.20260803150753946755.main.374.ga83a1a78" date="1785758400">- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="fa2b537b384c432bcb6487926e6f63e4e3057ca2467889302e547c6d76019276" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~375~g9d953b5c" rel="1.20260804094248867357.main.375.g9d953b5c.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~375~g9d953b5c-1.20260804094248867357.main.375.g9d953b5c" date="1785844800">- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="f378635ffa7ca6bab3264ef17861b9722ad4e37ec578bff63b0564c0f1e590bb" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~376~g1938ad8f" rel="1.20260804111857990040.main.376.g1938ad8f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~376~g1938ad8f-1.20260804111857990040.main.376.g1938ad8f" date="1785844800">- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="48c50573a75cee35ee0146dd7affb51f72b00061ee2b509aff30c3c650faed5d" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~377~g3537fca4" rel="1.20260804142148524153.main.377.g3537fca4.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~377~g3537fca4-1.20260804142148524153.main.377.g3537fca4" date="1785844800">- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="82baa15574a48b4acaad2a4fc89c3e65b553d32f5b779186ca464d59c69980e7" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~378~g29fe9d82" rel="1.20260804144009295970.main.378.g29fe9d82.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~378~g29fe9d82-1.20260804144009295970.main.378.g29fe9d82" date="1785844800">- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="dd62aad8b9853034ddde5f28985316e5894c501da25adf39d4f84b4aa9c59fa7" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~379~g91a1ccc7" rel="1.20260804161637336514.main.379.g91a1ccc7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~379~g91a1ccc7-1.20260804161637336514.main.379.g91a1ccc7" date="1785844800">- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="7729c4f154ef4b5644bb7d08155fc7edbc6e5e273bdae0889f494e536291ce1f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~380~gc8ba5d26" rel="1.20260804194814865617.main.380.gc8ba5d26.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~380~gc8ba5d26-1.20260804194814865617.main.380.gc8ba5d26" date="1785844800">- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="a284c31f4100219598c45b1e3567c11d32cd39a902e860b9a0ae1dc36201a648" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~381~g103cec6e" rel="1.20260805023620966078.main.381.g103cec6e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~381~g103cec6e-1.20260805023620966078.main.381.g103cec6e" date="1785931200">- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="45e13424ca5f37ef3b3ff5b89332545e9e46164850e3e37ac64351443836b67d" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~382~g0513616e" rel="1.20260805075826935255.main.382.g0513616e.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~382~g0513616e-1.20260805075826935255.main.382.g0513616e" date="1785931200">- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="231d5f2efa85dbd83e10633549a00413f98f2f8b3006636916bed0badee0df2f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~383~g2be2433a" rel="1.20260805133559556111.main.383.g2be2433a.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~383~g2be2433a-1.20260805133559556111.main.383.g2be2433a" date="1785931200">- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="623fa31f907767ff394fd6ccafdb2ab7e67ed72331b21432d42728429a25322f" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.3.0~main~384~g3c85b878" rel="1.20260805145638384781.main.384.g3c85b878.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.3.0~main~384~g3c85b878-1.20260805145638384781.main.384.g3c85b878" date="1785931200">- EDM-4983: Fix imageExport download with Basic-auth and Bearer registries (#3343) (amalykhi)
- EDM-4066: Catalog Item References on Devices (#3284) (Ben Keith)
- EDM-4764: Package-mode upstream documentation (#3344) (Gal)
- EDM-4180: Look up AAP role assignments by ansible_id instead of numeric ID (#3254) (Asaf Ben Natan)
- NO-ISSUE: Guard against dep activation failure in standalone gateway (#3095) (Ben Keith)
- EDM-4765: add package-mode E2E CI wiring (#3336) (Gal)
- EDM-4335: status update path optimizations (#3288) (Asaf Ben Natan)
- EDM-4981: Add optional flightctl-onboarding installation to imagebuilder (#3333) (kkyrazis)
- EDM-4777: Register encryption metrics collector before canary validation (#3338) (Assaf Albo)
- NO-ISSUE: allow serial and vnc app console sessions to coexist (#3327) (Asaf Ben Natan)
- EDM-4761: add package-mode image build infrastructure (#3331) (Eldar101)
- EDM-4762: Reject direct spec.os.image on package-mode devices (#3322) (Gal)
- EDM-4976: Fix e2e agent-image bundling failure on dangling images (#3330) (Gal)
- EDM-4779: Add encryption at rest user documentation (#3320) (Assaf Albo)
- EDM-4971: Support linked git worktrees in RPM build (#3324) (Gal)
- EDM-4972: Preserve build environment through sudo in create_agent_images.sh (#3325) (Gal)
- EDM-4973: Allow DNF to replace minimal packages in v10 variant build (#3326) (Gal)
- EDM-4969: Honor Podman health_status events for application status (#3321) (Asaf Ben Natan)
- NO-ISSUE: Default virt-launcher to v1.9.0 and disable passt workarounds (#3319) (Asaf Ben Natan)
- EDM-4894: Render encryption config in Quadlet service templates (#3316) (Assaf Albo)
- EDM-4760: Populate capabilities.osMode at enrollment approval (#3318) (Gal)
- EDM-4778: Add integration tests for encryption-at-rest infrastructure (#3303) (Assaf Albo)
- EDM-4846: Distinguish error messages for missing vs excess args in edit command (#3279) (Efilaluck)
- EDM-4845: Stabilize vulnerability lifecycle fleet check (#3317) (Eldar101)
- EDM-4889: Add encryption config to Helm values for key rotation support (#3315) (Assaf Albo)
- EDM-4758: Use capabilities.osMode presence for OS mismatch override (#3310) (Gal)
- NO-ISSUE: pin crun &gt;= 1.14.3 in CI to fix Smoke container build flake (#3314) (Gal)
- NO-ISSUE: remove tmpfs-backed local volumes on Quadlet/Compose app removal (#3311) (Asaf Ben Natan)
- EDM-4776: Migrate Repository, AuthProvider, and Device secrets to the active key (#3285) (Asaf Ben Natan)
- NO-ISSUE: Make VM render launcher image and passt workarounds configurable (#3302) (Asaf Ben Natan)
- EDM-4759: Skip OS update reconciliation paths on package-mode (#3306) (Gal)
- NO-ISSUE: overwrite protoc on custom runner images (#3309) (Asaf Ben Natan)
- NO-ISSUE: reduce E2E LPT makespan via configurable greenboot/dependency-sync timeouts and backup_restore parallelization (#3221) (Asaf Ben Natan)
- NO-ISSUE: lower integration CI parallelism to 4 procs (#3304) (Asaf Ben Natan)
- EDM-4885: reap leftover nc before VM console dial (#3293) (Asaf Ben Natan)
- NO-ISSUE: Bump github.com/getkin/kin-openapi from 0.133.0 to 0.144.0 (#3300) (dependabot[bot])
- EDM-4757: Atomic spec rejection on package-mode devices (#3274) (Gal)
- EDM-4827: Device Replace ownership; preserve UpdateDevice quirk (#3259) (Asaf Ben Natan)
- EDM-4777: Add database-backed encryption canary persistence (#3296) (Assaf Albo)
- EDM-4772: Lazy-start CLI e2e VM setup (#3247) (Eldar101)
- EDM-4876: Added capabilities to devices summary (#3287) (Celia Amador Gonzalez)
- EDM-4826: Fleet and catalog ownership on Replace/Patch (#3258) (Asaf Ben Natan)
- NO-ISSUE: Add Fedora 44 build targets to packit config (#3291) (kkyrazis)
- EDM-4775: Encrypt device rendered config and applications at rest (#3289) (Assaf Albo)
- NO-ISSUE: Wait for API endpoint after PAM auth restart (#3282) (Eldar101)
- EDM-4843: Retry imagebuild/export streams in case of EOF error (#3286) (Itzik Brown)
- NO-ISSUE: Fix version tiebreak when multiple tags share a commit (#3061) (kkyrazis)
- EDM-4861: fix intermittent restore failure and sensitive-data log messages (#3283) (amalykhi)
- EDM-4855: fix intermittent restore failure due to stale DB connection (#3278) (amalykhi)
- EDM-4742: Add VM app status diagnostics to e2e test (#3231) (Eldar101)
- EDM-4688: Separate temporary and permanent spec rendering errors (#3256) (Efilaluck)
- EDM-3677: Surface fleet rollout errors in device status (#3249) (Efilaluck)
- EDM-4335: add explicit pprof and pyroscope profiling config (#3275) (Asaf Ben Natan)
- EDM-4756: Declare osMode in enrollment request (#3273) (Gal)
- EDM-4785: enable if/else/with conditionals in fleet parameter templates (#3239) (Avishay Traeger)
- EDM-3530: Fix OIDC/OAuth2 auth provider URL normalization across all paths (#3151) (Asaf Ben Natan)
- NO-ISSUE: Sync air-gap embed after flightctl-greenboot Requires agent (#3255) (Gal)
- EDM-4755: Detect OS mode and report status.capabilities.osMode (#3253) (Gal)
- EDM-4774: Implement encryption-at-rest handlers for Repository and Au… (#3242) (Assaf Albo)
- NO-ISSUE: Fix flaky TestVMVNCSession initial-CR test (#3251) (Asaf Ben Natan)
- EDM-4699: Helm chart support for binding PVCs to pre-provisioned PVs (#3216) (Asaf Ben Natan)
- EDM-4164: patch CVE-2026-46595 by updating golang.org/x/crypto to v0.53.0 (#3228) (Celia Amador Gonzalez)
- EDM-4754: Verify package-mode and image-mode RPM install paths (#3246) (Gal)
- EDM-4752: Split flightctl-greenboot RPM subpackage (#3244) (Gal)
- EDM-4161/EDM-4101: user documentation for VM applications and remote-… (#3190) (Asaf Ben Natan)
- EDM-4786: Add flightctl telemetry gateway network policy (#3237) (Itzik Brown)
- EDM-4772: Remove unnecessary VM setup from selector and RBAC e2e suites (#3234) (Eldar101)
- EDM-4773: Add encryption key backup and restore support (#3238) (Assaf Albo)
- EDM-3605: Show enrollment QR code only after successful enrollment request creation (#3243) (Efilaluck)
- EDM-2392: Adjust observability tests to run on quadlets and OCP (#3175) (Itzik Brown)
- EDM-4667: isolated store subpackages (#3208) (Asaf Ben Natan)
- NO-ISSUE: add --force flag to take over an active app console session (#3229) (Asaf Ben Natan)
- EDM-4753: Add fieldSelector support for status.capabilities.osMode (#3236) (Gal)
- EDM-4743: Wire encryption-at-rest infrastructure (#3230) (Assaf Albo)
- NO-ISSUE: fix VM app console on Kubernetes (RBAC, UI wiring, annotation leaks, CLI errors) (#3224) (Asaf Ben Natan)
- EDM-4751: Add DeviceCapabilities and EnrollmentRequest osMode schema (#3233) (Gal)
- NO-ISSUE: Run backend image builds on flightctl-ci-runner (#3235) (Gal)
- EDM-4741: Fix edit no-args e2e expectation (#3232) (Eldar101)
- NO-ISSUE: overlap E2E aux service setup with VM boot, stream image bundle via skopeo (#3215) (Asaf Ben Natan)
- NO-ISSUE: Nest application lifecycle and app console commands under "flightctl app" (#3227) (Asaf Ben Natan)
- EDM-4722: Add observability (tracing and metrics) to encryption subsystem (#3217) (Assaf Albo)
- EDM-4727: fix console trigger to avoid bumping renderedVersion (#3193) (Asaf Ben Natan)
- NO-ISSUE: stop go/lint/dnf/bootc caches from thrashing the repo's 10GB cache budget (#3222) (Asaf Ben Natan)
- EDM-4520: Fix for e2e backup-restore ers cleanup (#3218) (Itzik Brown)
- EDM-4561: add registry auth support for imagebuilder-worker service images (#3205) (aekubacki)
- EDM-4376: Generate Helm ClusterRoles from static auth permissions (#3196) (kkyrazis)
- EDM-4560: add VNC support for VM application console (#3187) (Asaf Ben Natan)
- EDM-3791: Add AAP bearer token authentication support for Quadlet E2E tests (#3207) (amalykhi)
- NO-ISSUE: fix prune-ci-caches gh cache commands with no git checkout (#3219) (Asaf Ben Natan)
- NO-ISSUE: cache apt package downloads in setup-dependencies action (#3214) (Asaf Ben Natan)
- NO-ISSUE: exclude no-op runs from e2e health report timing averages (#3213) (Asaf Ben Natan)
- EDM-4099: [DEV] Agent lifecycle reconciliation — CLI support (#3202) (Asaf Ben Natan)
- NO-ISSUE: fix import.sh including failed images from BundleImages (#3200) (aekubacki)
- NO-ISSUE: Fix authprovider browser login env (#3183) (Eldar101)
- EDM-4098: [DEV] Agent lifecycle reconciliation — Quadlet, Container, Compose, VM, and Helm (#3117) (Asaf Ben Natan)
- NO-ISSUE: add buildah cache for smoke test container builds (#3212) (Asaf Ben Natan)
- EDM-2822: Improve expired OAuth2 token error message (#3194) (Efilaluck)
- EDM-4102: [DEV] desiredState, restartGeneration, and Stopped/Stopping API schema (#3198) (Asaf Ben Natan)
- EDM-4559: Wait for authentication to be available after certificate rotation tests (#3204) (Itzik Brown)
- EDM-4690: Add encryption subsystem infrastructure (#3195) (Assaf Albo)
- NO-ISSUE: Remove wildcard from flightctl-imagebuilder-worker scc (#3199) (Itzik Brown)
- NO-ISSUE: Update observability image tags (#3201) (kkyrazis)
- NO-ISSUE: Fix fleet rollout skipping re-render when renderedTemplateVersion is stale, Fixes #3141 (#3142) (Miroslav Kolar)
- NO-ISSUE: fixes a case where e2e are faked pass by failed build steps (#3191) (Asaf Ben Natan)
- EDM-3400:Create an automation for using RHEM behind a HA Proxy (#3178) (Eldar101)
- EDM-4107: CLI app serial console (#3135) (Asaf Ben Natan)
- EDM-4009: Fix confusing error message in edit command (#3179) (Efilaluck)
- EDM-4106: implement VM serial console via podman exec (#3109) (Asaf Ben Natan)
- EDM-4258: Vulnerability-sync periodic task produces error logs when VulnerabilityReporting is not configured (#3150) (bugs-buddy-jira-ai-issue-solver[bot])
- NO-ISSUE: use pre-built vm-to-quadlet image in vmRender integration suite (#3188) (Asaf Ben Natan)
- NO-ISSUE: replace ineffective Go host cache with buildah cache for container builds (#3186) (Asaf Ben Natan)
- EDM-4601: Add Basic auth support for OCI repositories (#3189) (Asaf Ben Natan)
- EDM-4095: switch VM render to vm-to-quadlet, expose publishPorts, revert .kube support (#3182) (Asaf Ben Natan)
- NO-ISSUE: add unit and integration test health reports (#3184) (Asaf Ben Natan)
- NO-ISSUE: fix: flightctl-mirror-images fails when installed via RPM (#3166) (aekubacki)
- NO-ISSUE: disable MicroShift helm tests on cs10-bootc (#3185) (Asaf Ben Natan)
- EDM-4380: support quadlet deployments in dependency sync e2e tests (#3140) (hferber1)
- EDM-4505: Adding db SSL volumes and volumes mounts when using externaldb and SSL (#3177) (Itzik Brown)
- EDM-4429: flightctl-backup fails on quadlet/podman deployments with external database (#3171) (Samuel De La Cruz Lopez)
- NO-ISSUE: Fix standalone OAuth2 authprovider test (Eldar Weiss)
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4336: SignerServerSvc issues server certificates with attacker-chosen SANs → fleet-wide MITM (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-2349: Expand multiorg RBAC e2e coverage (Itzik Brown)
- EDM-4168: bump golang.org/x/crypto to v0.53.0 for SSH security fixes (Amir Yogev)
- EDM-4168: patch CVE-2026-39821 by updating golang.org/x/net to v0.55.0 (Amir Yogev)
- NO-ISSUE: patch CVE-2026-33815 by updating pgx to v5.9.2 (Amir Yogev)
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4246: Agent ignores http proxy configuration (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4249: RPM upgrade leaves stale flightctl-cli-artifacts-init.service unit reference (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4104: regenerate API types after x-enum-varnames addition (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- EDM-4104: add env.template to RPM spec for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: fix gci import formatting in server.go (Asaf Ben Natan)
- EDM-4104: fix remote-access Helm config: add DB/KV, drop client-signer (Asaf Ben Natan)
- EDM-4104: add redeploy-remote-access make target (Asaf Ben Natan)
- EDM-4105: wire remote-access image into kind/Helm deployment script (Asaf Ben Natan)
- EDM-4105: wire DB/KV secrets and startup ordering into remote-access quadlet (Asaf Ben Natan)
- EDM-4105: remove CA signing key dependency from remote-access service (Asaf Ben Natan)
- EDM-4105: address review feedback (Asaf Ben Natan)
- NO-ISSUE: fix oasdiff agent API check to allow external refs (Asaf Ben Natan)
- EDM-4105: add application console WebSocket endpoint to remote-access service (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: document remoteAccess.resources in Helm chart README (Asaf Ben Natan)
- EDM-4104: route remote-access service API through main gateway (8443), not a dedicated port (Asaf Ben Natan)
- EDM-4104: terminate TLS for service API (3444) at nginx, not at service (Asaf Ben Natan)
- EDM-4104: expose both remote-access ports via the podman gateway (Asaf Ben Natan)
- EDM-4104: revert podman changes that conflict with stacked PRs (Asaf Ben Natan)
- EDM-4104: address review feedback (Asaf Ben Natan)
- Replace wget with curl in observability documentation (Itzik Brown)
- NO-ISSUE: move pipe cleanup to defer so it runs on assertion timeout (Amir Yogev)
- NO-ISSUE: fix TestListenForEvents race with pipe lifecycle and mock expectations (Amir Yogev)
- NO-ISSUE: fix TPM NV read chunk size to respect TPM_PT_NV_BUFFER_MAX, Fixes #3126 (Miroslav Kolar)
- EDM-4104: load remote-access image into kind and add to deploy-helm prerequisites (Asaf Ben Natan)
- EDM-4104: fix gofmt struct field alignment (Asaf Ben Natan)
- EDM-4104: use server TLS config (not mTLS) for service-api HTTP listener (Asaf Ben Natan)
- EDM-4104: add remote-access.{baseDomain} SAN to cert helper (Asaf Ben Natan)
- EDM-4104: align remote-access service-api TLS with other services (Asaf Ben Natan)
- EDM-4104: switch helm upgrade from --reuse-values to --reset-then-reuse-values (Asaf Ben Natan)
- EDM-4104: wire cert provisioning for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Quadlet, image config, renderer, and RPM entries for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Helm chart templates for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add Containerfile and Makefile container target for flightctl-remote-access (Asaf Ben Natan)
- EDM-4104: add flightctl-remote-access service scaffold (binary + server stubs) (Asaf Ben Natan)
- NO-ISSUE: fix YAML-breaking heredoc and stale RSA host key (Asaf Ben Natan)
- NO-ISSUE: address review feedback on e2e health report publish step (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- NO-ISSUE: publish e2e health report to flightctl-reports gh-pages (Asaf Ben Natan)
- EDM-4382: Validate credentials file permissions before reading (Kyle Kyrazis)
- EDM-4382: Update login docs for credentials-file and env vars (Kyle Kyrazis)
- EDM-4382: Add secure credential passing to flightctl login (Kyle Kyrazis)
- NO-ISSUE: fix lint-fix container to run as host user (Asaf Ben Natan)
- NO-ISSUE: Reduce make lint wall-clock time by ~63% and add lint-fix target (Asaf Ben Natan)
- NO-ISSUE: Fix test descriptions in pubsub_test.go to follow naming convention (Asaf Ben Natan)
- NO-ISSUE: Document RACE and COVERAGE opt-out flags in AGENTS.md (Asaf Ben Natan)
- NO-ISSUE: Add RACE and COVERAGE opt-out flags to unit-test, remove -count=1 (Asaf Ben Natan)
- NO-ISSUE: Remove 1.5s retry backoff sleep from alertmanager EventualSuccess test (Asaf Ben Natan)
- NO-ISSUE: Remove redundant sleeps after terminal UpdateCondition calls in imagebuilder tests (Asaf Ben Natan)
- NO-ISSUE: Replace invalid DNS hostnames with loopback:1 in tests to avoid timeouts (Asaf Ben Natan)
- NO-ISSUE: Cache OpenAPI router in ApplyJSONPatch to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Make health checker poll interval injectable to fix slow unit tests (Asaf Ben Natan)
- NO-ISSUE: Fix unit test classification and add proper pkg/queues tests (Asaf Ben Natan)
- EDM-3679: bump Go 1.25.8 to 1.25.9 in CI workflows, Containerfiles, and test module (Amir Yogev)
- EDM-3679: bump toolchain in codegen modfiles to go1.25.9 (Amir Yogev)
- EDM-3679: patch CVE-2026-32280 by updating Go toolchain to go1.25.9 (Amir Yogev)
- EDM-3778: VM Agent Helm Application Tests SSH fix (Samuel de la Cruz)
- EDM-2054: inject mirror registry config into QCOW for MicroShift (David Asulin)
- EDM-3853: CI fix to redit (Eldar Weiss)
- EDM-4334: Fix backup/restore for external database deployments (amalykhi)
- EDM-4100: Refactor VM identity into VMSpec and parse namespace from pod YAML (Asaf Ben Natan)
- EDM-4100: Derive VM container and domain names from pod YAML (Asaf Ben Natan)
- EDM-4100: Address review feedback round 2 (Asaf Ben Natan)
- EDM-4100: Address review feedback — route VM status exec through podman client (Asaf Ben Natan)
- EDM-4100: using annotation to detect vm workload (Asaf Ben Natan)
- EDM-3454: precompute warning message, skip info override on non-Online status (Gal Elharar)
- EDM-3454: persist config warnings via status exporter, consolidate tests (Gal Elharar)
- EDM-3454: surface skipped drop-in warnings in device status (Gal Elharar)
- EDM-3454: Skip invalid config drop-ins instead of crashing (Gal Elharar)
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: address PR feedback (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-4337: SQL injection in CountByLabels via disruptionBudget.groupBy with ResourceSync validation bypass (bugs-buddy-jira-ai-issue-solver[bot])
- EDM-3949: Added backup and restore test suite (Samuel de la Cruz)
- EDM-1057: Consolidate allMissing and anyMissing into single loop (Gal Elharar)
- EDM-1057: Address PR review feedback (Gal Elharar)
- EDM-1057: Fatal exit on missing spec files (Gal Elharar)
- EDM-1057: Recover from missing spec files during reconciliation (Gal Elharar)
- EDM-3858: Fix quadlet E2E for remote VM environments (David Asulin)
- EDM-4097: Address review feedback — extract lookupKubeYamlPath helper and use errors.Is (Asaf Ben Natan)
- EDM-4097: Address review feedback — explicit sentinel check in namespacePodYAML (Asaf Ben Natan)
- EDM-4097: updated kubevirttopod container (Asaf Ben Natan)
- EDM-4097: Add pod YAML helpers for VM detection and OCI prefetch (Asaf Ben Natan)
- NO-ISSUE: fix fips for kubevirt-vm-to-pod (Asaf Ben Natan)
- EDM-4184: multi-org cleanup to fix regression in parameterizable templates (Eldar Weiss)
- NO-ISSUE: add system requirements sizing table to installation docs (Alex Kubacki)
- EDM-4096: use quadlet.Unit parser in buildKubeUnit instead of string replace (Asaf Ben Natan)
- EDM-4096: align vmrender test lifecycle with canonical tasks integration test pattern (Asaf Ben Natan)
- EDM-4096: inject Yaml=pod.yaml into user-provided .kube when Yaml= directive is absent (Asaf Ben Natan)
- EDM-4096: Address review feedback — harden test Containerfile, guard nil converter, fix test lifecycle and .kube content assertion (Asaf Ben Natan)
- EDM-4096: use section-aware quadlet parser and validate apiVersion in pod manifests - Replace raw line scanning in parseKubeYamlDirective with quadlet.NewUnit   + Lookup so that Yaml= is only extracted from the [Kube] section, not from   unrelated sections such as [Unit] or [Install]. - Add apiVersion presence check to validatePodManifest; a manifest with   kind: Pod but empty apiVersion is not a valid Kubernetes object and will   fail downstream. (Asaf Ben Natan)
- EDM-4096: address PR review feedback (Asaf Ben Natan)
- EDM-4096: render VmApplication into QuadletApplication via kubevirt-vm-to-pod (Asaf Ben Natan)
- NO-ISSUE: restore air-gapped-operations.md to fix link-check CI (Alex Kubacki)
- NO-ISSUE: remove air-gapped-operations.md — will be provided by PR #3114 (Alex Kubacki)
- EDM-4036: clarify prep machine OS requirements for --bundle-rpms (Alex Kubacki)
- EDM-4036: address review feedback — simplify decision tree and broaden platform scope (Alex Kubacki)
- EDM-4036: add consolidated air-gapped installation guide (Alex Kubacki)
- EDM-4023/4028: clarify that local registry workflow applies to both OS and workload images (Alex Kubacki)
- EDM-4033/4023/4028: address review feedback from kkyrazis (Alex Kubacki)
- NO-ISSUE: add air-gapped-operations.md to docs index (Alex Kubacki)
- EDM-4032: add OCP artifact packaging section to offline-portable-media.md (Alex Kubacki)
- EDM-4035: add Podman Quadlet configuration for disconnected image builder (Alex Kubacki)
- EDM-4034: expand ITMS documentation with policy options, verification and troubleshooting (Alex Kubacki)
- EDM-4033/4023/4028: add air-gapped enrollment and operations documentation (Alex Kubacki)
- EDM-4177: Fix flightctl-restore service recovery on database connection failure (amalykhi)
- EDM-4185: Fix RHEM profile name mismatch (rawagner)
- EDM-4159: Document custom CA integration with cert-manager (asafbss)
- EDM-3844: Adding e2e tests for Automated Synchronization for Git &amp; Secrets &amp; HTTP (Hadar Ferber)
- NO-ISSUE: Do not add safe directory duplicates (Celia Amador)
- EDM-4162: Reject consecutive dots in config name validation (Gal Elharar)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- NO-ISSUE: Fix ulimit documentation for imagebuilder (Asaf Ben Natan)
- NO-ISSUE: Update CodeRabbit config: refine action pinning, enforce AI attribution (Andy Dalton)
- EDM-3405: Address PR review comments (David Asulin)
- EDM-3405: Auto-detect disconnected env and fall back to OCP mirror (David Asulin)
- EDM-3953: document --nobest behaviour in install-rpms.sh (Alex Kubacki)
- EDM-3953: add --nobest to dnf install in install-rpms.sh to handle minor version mismatches (Alex Kubacki)
- EDM-4095: Mention optional .kube file in VmApplication schema description (Asaf Ben Natan)
- EDM-4095: Add VmApplication API types, OpenAPI spec, and validation (Asaf Ben Natan)
- EDM-3953: add flightctl-mirror-images flag reference table to offline install doc (Alex Kubacki)
- EDM-3953: update agent offline install doc to use flightctl-mirror-images (Alex Kubacki)
- EDM-3953: drop --rpm-version flag — auto-pin from --tag-override covers all cases (Alex Kubacki)
- EDM-3953: extract RPM version pinning into resolveRPMVersion to reduce cyclomatic complexity (Alex Kubacki)
- EDM-3953: document --rpm-version flag and auto-pin behaviour in README and offline install doc (Alex Kubacki)
- EDM-3953: pin RPM version to match --tag-override to prevent bundle mismatch (Alex Kubacki)
- NO-ISSUE: Show PR number in backport description (Ben Keith)
- NO-ISSUE: Exclude closed+unmerged PRs from verify-backports script (Ben Keith)
- NO-ISSUE: clarify which PR is not merged in backport script (Ben Keith)
- NO-ISSUE: Add option for worktree removal in backport script (Ben Keith)
- NO-ISSUE: Remove empty file (rawagner)
- NO-ISSUE: Add docs for ImagePromotion and Repository base images (rawagner)
- EDM-3621: fix comma-injection test to use v1alpha1-capable fake client (Asaf Ben Natan)
- EDM-3621: address CodeRabbit review feedback (Asaf Ben Natan)
- EDM-3621: add CLI autocompletion for catalog, catalogitem, and imagebuilder resource names (Asaf Ben Natan)
- EDM-3807: Improve logic to compute img suffix during upgrades (rawagner)
- NO-ISSUE: Add usernames to verify-backport output (Ben Keith)
- EDM-3938: Delete preupgrade-scale job also before-hook-creation (rawagner)
- NO-ISSUE: Adjust API port in quadlets (Itzik Brown)
- NO-ISSUE: Script to verify backports (Ben Keith)
- NO-ISSUE: Backport script/docs (Ben Keith)
- EDM-3697: fix syncDatabasePasswords to read from Podman secret directly (Asaf Ben Natan)
- EDM-3697: added flightctl-gateway for stop/started services when restoring (Asaf Ben Natan)
- EDM-3697: fix credentails extraction for quadlets (Asaf Ben Natan)
- EDM-3697: remove unrelated files from branch (amalykhi)
- EDM-3697: read master password from secret for password sync (amalykhi)
- EDM-3697: sync database passwords after restore (amalykhi)
- NO-ISSUE: better readme (Asaf Ben Natan)
- EDM-3936: added ulimit flag and troubleshooting info (Asaf Ben Natan)
- EDM-3697: fix binary copy and restore in E2E tests (amalykhi)
- EDM-4119: Fix agent log priority mapping for journald (asafbss)
- EDM-4120: Use keepalive for gateway API connections (Ben Keith)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in Helm values and README (Alex Kubacki)
- EDM-3953: fix mirror-images reference in values.yaml.gotmpl (Alex Kubacki)
- EDM-3953: fix doubled flightctl-flightctl-mirror-images in docs and README (Alex Kubacki)
- EDM-3953: update prose references from mirror-images to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: rename mirror-images binary to flightctl-mirror-images (Alex Kubacki)
- EDM-3953: add mirror-images binary to flightctl-cli RPM package (Alex Kubacki)
- EDM-3953: remove kv-standalone image entries from el9/el10 images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el10/images.yaml (Alex Kubacki)
- EDM-3953: add kv-standalone entry for docker.io/library/redis in el9/images.yaml (Alex Kubacki)
- EDM-3953: fix kv image in el9/images.yaml to match quadlet and bundle (Alex Kubacki)
- EDM-4125: fixed device taking stale data on dependency change (Asaf Ben Natan)
- NO-ISSUE: Fix authprovider e2e setup (Eldar Weiss)
- EDM-4120: Unix socket for standalone agent API (Ben Keith)
- EDM-3607: Ensure ClusterRole/Binding is created before running the cleanup job (rawagner)
- EDM-3955: replace flightctl CLI verification with curl in OCP offline doc (Alex Kubacki)
- EDM-3955: add createrepo_c to prep machine prerequisites (Alex Kubacki)
- EDM-3955: revert flightctl CLI verification to curl in offline install doc (Alex Kubacki)
- EDM-3955: address tester feedback on disconnected install docs (Alex Kubacki)
- EDM-3953: rename redhat-* variants to rhem-* to match product naming (Alex Kubacki)
- EDM-3955: rewrite OCP disconnected install doc to use mirror-images tool (Alex Kubacki)
- EDM-2854: Cleanup job should remove other jobs too (rawagner)
- EDM-4083: Run backup inside VM for quadlet e2e tests (amalykhi)
- EDM-4076: Allow defining displayName for IP new catalog items (Celia Amador)
- NO-ISSUE: skip Slack notification when webhook URL is not set (Asaf Ben Natan)
- NO-ISSUE: fix e2e health report missing system dependencies (Asaf Ben Natan)
- EDM-4053: Suppress nginx version header (Ben Keith)
- EDM-3953: fix --tag-override ignored for images with explicit tag: latest (Alex Kubacki)
- EDM-3783: Quadlet Gateway After Dependencies (Ben Keith)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: consolidated make agent-vm (Asaf Ben Natan)
- NO-ISSUE: addressed more comments (Asaf Ben Natan)
- NO-ISSUE: addressed comments (Asaf Ben Natan)
- NO-ISSUE: e2e health report (Asaf Ben Natan)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- EDM-3906: Added quadlets multiorg test suite compatibility (Samuel de la Cruz)
- NO-ISSUE: Add gateway image back (Itzik Brown)
- EDM-3953: add mirror-images tool for air-gapped FlightCtl installation (Alex Kubacki)
- EDM-4038: Own license dirs in CLI RPM for clean uninstall (Kyle Kyrazis)
- NO-ISSUE: fix run-e2e label (Asaf Ben Natan)
- NO-ISSUE: fix e2e filter (Asaf Ben Natan)
- EDM-3783: Expose old ports by default on quadlets deploy (Ben Keith)
- NO-ISSUE: make rpm postun cleanup non-fatal (Asaf Ben Natan)
- EDM-4021: clean up temporary container storage dirs on job completion and RPM uninstall (Asaf Ben Natan)
- EDM-4057: Remove ReloadCmd directive from flightctl-gateway.container (Itzik Brown)
- EDM-2708: Approve agent VM enrollment in workflow (Eldar Weiss)
- EDM-2539: Auth provider tests (Eldar Weiss)
- EDM-2708: Add agent VM PR check (Eldar Weiss)
- EDM-4052: Add kubectl dependency check for Kubernetes restore (amalykhi)
- EDM-4057: Gateway handling of Quadlet container restarts (Ben Keith)
- EDM-89237: Add label 89237 to bootc timer e2e test (Tal Hilzenrat)
- EDM-3907: Add quadlet support to FIPS test suite (Samuel de la Cruz)
- EDM-3904: User documentation for backup and restore procedures (amalykhi)
- EDM-4038: Add alertmanager dir ownership to services RPM (Kyle Kyrazis)
- EDM-1990: Use quay.io nginx image for file server to avoid docker.io pull limits in CI (David Asulin)
- EDM-1990: Address PR review feedback - use lo.ToPtr and stop file server (David Asulin)
- EDM-1990: Propagate container inspect error in file server Start (David Asulin)
- EDM-1990: Address PR review feedback on file server auxiliary (David Asulin)
- EDM-1990: Add HTTP file server auxiliary and restore HTTP config provider in test 78684 (David Asulin)
- NO-ISSUE: Address PR review feedback (David Asulin)
- EDM-1990: Fix test 78684 for disconnected environments (David Asulin)
- NO-ISSUE: remove committed test-timings.json and add to .gitignore (Asaf Ben Natan)
- NO-ISSUE: fix lint error in main (Asaf Ben Natan)
- EDM-3812: Add e2e test of default device alias during registration (Hadar Ferber)
- NO-ISSUE: addressed CR comments , included STDDev (Asaf Ben Natan)
- NO-ISSUEL dynamic weight calc - added suite weight (Asaf Ben Natan)
- NO-ISSUE: added dynamic weight calculation for e2e (Asaf Ben Natan)
- EDM-4005: deny console access to viewer role (Asaf Ben Natan)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- EDM-3988: Fix cert rotation test flakyness (Samuel de la Cruz)
- NO-ISSUE: Accept Made-with trailer for AI attribution (Andy Dalton)
- NO-ISSUE: Address PR review feedback on CodeRabbit config (Andy Dalton)
- NO-ISSUE: Fix CodeRabbit approval settings (Andy Dalton)
- NO-ISSUE: Disable CodeRabbit automatic PR approval (Andy Dalton)
- NO-ISSUE: Add YAML language server schema directive to .coderabbit.yaml (Andy Dalton)
- NO-ISSUE: Overhaul CodeRabbit config for comprehensive PR reviews (Andy Dalton)
- EDM-4016: Fix gateway quadlet image rendering (Kyle Kyrazis)
- EDM-3989: Detect bootc timer in %post with find for image builds (Tal Hilzenrat)
- EDM-3399: Improve bootc-timer e2e detection and skip messaging (Tal Hilzenrat)
- EDM-3309: re-added Error: prefix to conform with e2e (Asaf Ben Natan)
- EDM-3309: more CR comments (Asaf Ben Natan)
- EDM-3309: some CR comment fixes (Asaf Ben Natan)
- EDM-3309: standardize CLI error printing and made more human readable (Asaf Ben Natan)</changelog>
</package>
<package pkgid="78b6682880353473f557fc24cdb789a1d16b9c7fff1c6464f4d46b6cf0210ad2" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~10~gf49a3b89" rel="1.20260810144413042758.main.10.gf49a3b89.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~10~gf49a3b89-1.20260810144413042758.main.10.gf49a3b89" date="1786363200">- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="dd8ac4b41e0d4a6081cd22b44ca402146cea6b772cf3c83658df3a1e6b0b49e5" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~11~g7f719e2f" rel="1.20260810151515739146.main.11.g7f719e2f.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~11~g7f719e2f-1.20260810151515739146.main.11.g7f719e2f" date="1786363200">- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="6544c09a2323ce5bdbe6aae16095f3f460bc967de2443e238159ce722bfa9f90" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~12~g2716acd1" rel="1.20260811091013271515.main.12.g2716acd1.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~12~g2716acd1-1.20260811091013271515.main.12.g2716acd1" date="1786449600">- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="99dd254d5d3b12176832b932248e34f1b0ab9a074a38cfa33871b39b8839afb3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~13~g20c96196" rel="1.20260811172632488505.main.13.g20c96196.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~13~g20c96196-1.20260811172632488505.main.13.g20c96196" date="1786449600">- EDM-5028: Add Device/Fleet Mutate CAS with status/annotation wrappers (#3353) (Asaf Ben Natan)
- EDM-4780: add encryption-at-rest e2e tests (#3292) (amalykhi)
- EDM-4968: Package-mode OS guards for spec.os.catalogItemRef (#3356) (Gal)
- EDM-4851: add e2e test for imagebuild with Basic-auth registry (#3313) (amalykhi)
- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a21e3ea9440ffc0ae39524016f470b116c85f38e0c7463a3bf9d9bcd64706893" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~1~gfa7965ea" rel="1.20260807141724724017.main.1.gfa7965ea.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~1~gfa7965ea-1.20260807141724724017.main.1.gfa7965ea" date="1786104000">- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="05c281bfe0d5557d27ae6a1217b7901263e1f9870809288954e26a76c91fa541" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~2~g2ac5b8ae" rel="1.20260808005703267878.main.2.g2ac5b8ae.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~2~g2ac5b8ae-1.20260808005703267878.main.2.g2ac5b8ae" date="1786190400">- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="b1b43149d5f7710a50cbb617a2f7d1f5355b5c56ee61f9c790057a5faffe55a3" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~3~gc1ffa1c8" rel="1.20260809060829247459.main.3.gc1ffa1c8.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~3~gc1ffa1c8-1.20260809060829247459.main.3.gc1ffa1c8" date="1786276800">- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="a1aabab71f95d61e5b3bc9609cbd6a75c8999209caa65fd0f48fac4fc4551535" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~5~g644a3854" rel="1.20260809071355938506.main.5.g644a3854.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~5~g644a3854-1.20260809071355938506.main.5.g644a3854" date="1786276800">- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="1db35a138b9d8d9f4c5bb891ab68fe2dc869cec749374725772107e14b40de1b" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~6~gd287f0d3" rel="1.20260809115757359409.main.6.gd287f0d3.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~6~gd287f0d3-1.20260809115757359409.main.6.gd287f0d3" date="1786276800">- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="bd991c47af7b204d8331f4593267dc684b59b969933f09cd417e97019cba8354" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~7~g5287cbe0" rel="1.20260809144400647586.main.7.g5287cbe0.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~7~g5287cbe0-1.20260809144400647586.main.7.g5287cbe0" date="1786276800">- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="42cd4c9c0fa8ef473f32123b36480e1df54516c03ce7b7a22acf1d97af752512" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~8~gf74063a7" rel="1.20260810110702464526.main.8.gf74063a7.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~8~gf74063a7-1.20260810110702464526.main.8.gf74063a7" date="1786363200">- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c4c9199f3877f92d8e08f0dc89192e699252dd777cbcf5916aaa2c897f3a2e59" name="flightctl-services" arch="aarch64">
  <version epoch="0" ver="1.4.0~main~9~g49670808" rel="1.20260810133818530181.main.9.g49670808.fc44"/>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Ben Keith &lt;bkeith@redhat.com&gt; - 1.0-1" date="1762948800">- Make observability and telemetry-gateway packages require services package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1763380800">- Refactoring quadlet install, add standalone utils</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0-1" date="1764158400">- Adding certificate generation service</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.4.0~main~9~g49670808-1.20260810133818530181.main.9.g49670808" date="1786363200">- NO-ISSUE: Clarify VM app console not-ready errors with a stable error code (#3358) (Asaf Ben Natan)
- EDM-4842: Fix console rendered version e2e assertion (#3355) (Eldar101)
- EDM-4988: Keep crash-looping VM apps Degraded until healthy (#3351) (Asaf Ben Natan)
- EDM-4970: Harden authprovider API readiness probe (#3329) (Eldar101)
- NO-ISSUE: Clarify imagebuilder RHEL config and use quadlet drop-ins (#3349) (kkyrazis)
- EDM-4988: Improve VM application error visibility (#3346) (Asaf Ben Natan)
- NO-ISSUE: Stop systemd services and reset failed status after an app stop (#3335) (Itzik Brown)
- EDM-4066: Add catalog item references e2e tests (#3308) (talhil-rh)
- EDM-5023: Fix Podman restore race condition and use safe SQL identifier quoting (#3348) (amalykhi)</changelog>
</package>
<package pkgid="c8902ece2c66c0046b53d5aa7640ef921cc1200fbea4fcc28219edc4fb6c79c8" name="flightctl-telemetry-gateway" arch="aarch64">
  <version epoch="0" ver="1.0.0~main~197~g8233d72a" rel="1.20251105075527768767.main.197.g8233d72a.fc44"/>
  <changelog author="Miguel Angel Ajo &lt;majopela@redhat.com&gt; - 0.4.0-1" date="1738929600">- Add selinux support for console pty access</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-1" date="1743422400">- Add services sub-package for installation of containerized flightctl services</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.6.0-2" date="1743681600">- Add sos report plugin support</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-3" date="1744372800">- Add versioning to container images within flightctl-services sub-package</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 0.6.0-4" date="1744718400">- Add ability to create an AAP Oauth Application within flightctl-services sub-package</changelog>
  <changelog author="Ori Amizur &lt;oamizur@redhat.com&gt; - 0.9.0-1" date="1751803200">- Add support for Flight Control standalone observability stack</changelog>
  <changelog author="Sam Batschelet &lt;sbatsche@redhat.com&gt; - 0.9.0-2" date="1752580800">- Improve selinux policy deps and install</changelog>
  <changelog author="Ilya Skornyakov &lt;iskornya@redhat.com&gt; - 0.10.0" date="1759924800">- Add pre-upgrade database migration dry-run capability</changelog>
  <changelog author="Dakota Crowder &lt;dcrowder@redhat.com&gt; - 1.0" date="1761566400">- Add must-gather script for the services sub package</changelog>
  <changelog author="Packit &lt;hello@packit.dev&gt; - 1.0.0~main~197~g8233d72a-1.20251105075527768767.main.197.g8233d72a" date="1762344000">- NO-ISSUE: Fix TLD in image labels (Frank A. Zdarsky)
- EDM-2459: add pprof server for runtime profiling (#1887) (Assaf Albo)
- EDM-2302: User quadlet docs (Dakota Crowder)
- EDM-2495: Add HSTS and X-Content-Type-Options headers (Avishay Traeger)
- EDM-2424: helm - preserve migration job (#1866) (Ilya)
- EDM-2250: Treat graceful HTTP shutdown correctly in metrics server (#1888) (Assaf Albo)
- NO-ISSUE: Temporarily disable backward compatibility integration tests (Avishay Traeger)
- EDM-2404: Add debug logs to snapshot restore (sserafin)
- NO-ISSUE: Remove rate limit environment variables (Avishay Traeger)
- NO-ISSUE: Add explicit enabled field for rate limiting configuration (Avishay Traeger)
- EDM-2405: Increase default rate limiting from 60/10 to 300/20 requests (Avishay Traeger)
- EDM-2378: automate flightctl edit (Eldar Weiss)
- EDM-2240: Default to YAML format when using --rendered (Celia Amador)
- EDM-2240: Fix bug lastSeen allowed for multiple devices but info not shown (Celia Amador)
- EDM-2240: Flags shown in help for 'get' commands are contextual (Celia Amador)
- EDM-2300: Services must-gather script (Dakota Crowder)
- NO-ISSUE: Use selected organization when creating new devices with agent-vm (Celia Amador)
- EDM-2739: automate new get format (Eldar Weiss)
- EDM-2233: Automation of Deny feature (Eldar Weiss)
- EDM-2168: Fix for [It] VM Agent behavior status Device status tests (Itzik Brown)
- EDM-2031: Added checking number of devices in each fleet test (Hadar Ferber)
- NO-ISSUE: add missing labels (#1861) (Ilya)
- EDM-2419: fixed meter collector to have a single label (Asaf Ben Natan)
- EDM-2412: store: return not found if checkpoint does not exist (Sam Batschelet)
- EDM-2408: Move redis config for quadlets kv service to a .conf file to prevent directory permissions issues (Dakota Crowder)
- EDM-2409: Add internal ctx key to alert exporter service (Dakota Crowder)
- EDM-2400: Fix bootc linting issue for CentOS buildinfo directories (Gal Elharar)
- EDM-2385:Redis integration test race  condition fix (amalykhi)
- EDM-1961: Enhance CLI Login error handling and Docs (Siddarth R)
- EDM-2396: Fix build source tag detection (Ben Keith)
- EDM-2387: Allow flightctl_agent_t to get status of systemd services (Ben Keith)
- NO-ISSUE: Fix commit message check for backport branches (Avishay Traeger)
- EDM-2322: Flightctl is using the Internal database when enabling the … (#1797) (Gregory Shilin)
- EDM-2354: agent: remove klog as dependency (Sam Batschelet)
- EDM-2354: device/systeminfo: improve context handling (Sam Batschelet)
- EDM-2354: packaging/greenboot: bump timeout (Sam Batschelet)
- EDM-2354: test/agent: use drop-in for system-info config (Sam Batschelet)
- EDM-2350-v2: Fix documentation to reference correct telemetery gateway export listen port (9464) for prometheus (Ori Amizur)
- NO-ISSUE: move files (JasonN3)
- EDM-2350: [documenttion] Telemetry quadlets configuration is wrong in the doc (Ori Amizur)
- EDM-2236: use require package for approve command tests (Gal Elharar)
- EDM-2351: Update doc refs from new utilty usage, accept stdin input in py yaml utility (Dakota Crowder)
- EDM-2253: Add hostname support to systeminfo and improve agent config (Gal Elharar)
- EDM-2251: remove start condition for db-migrate (#1815) (Ilya)
- NO-ISSUE: workflow disk cleanup config update (Ilya)
- EDM-2367: Separate last seen from device (Ori Amizur)
- EDM-2161: detect integration tests base (#1809) (Ilya)
- EDM-2236: Add support for space-separated approve command syntax (Gal Elharar)
- EDM-2341: flightctl-userinfo-proxy container doesn't support the Memory setting (Ori Amizur)
- EDM-1834: Agent attempts to reconcile before reboot on OS upgrade (noga-magen)
- EDM-2351: Add python utility for transforming yaml (Dakota Crowder)
- EDM-2352: improve e2e beforeEach stability (sserafin)
- EDM-1392: Add fallback for immediate /var/lib/flightctl creation (Gal Elharar)
- EDM-2214: create migration pod just once and retry without a limit (#1794) (Ilya)
- EDM-2288: remove yq dependency (Siddarth R)
- EDM-1601: Prevent Invalid Memory monitor type path fields (Gal Elharar)
- EDM-1601: Add unit tests for ResourceMonitor validation (Gal Elharar)
- EDM-1601: Prevent duplicate monitorType and invalid CPU path fields (Gal Elharar)
- EDM-1601: Add validation to prevent duplicate monitorType in fleet resources (Gal Elharar)
- NO-ISSUE: dont shutdown deployments in ACM (#1793) (Ilya)
- NO-ISSUE: fix broken link (#1796) (Ilya)
- NO-ISSUE: Fix custom-info examples in agent-vm (Celia Amador)
- NO-ISSUE: Fix git container on deploy (#1772) (Siddarth Royapally)
- EDM-2214: helm add migration wait init containers to services (#1785) (Siddarth Royapally)
- EDM-2286: Add correct selinux policy to custom-info directory (#1788) (kkyrazis)
- EDM-2259: Fix draining workloads on shutdown (#1786) (kkyrazis)
- NO-ISSUE: deploy/helm: fix doc links (Sam Batschelet)
- EMD-2207: Remove Docs and duplicate licenses from RPMs (#1781) (kkyrazis)
- Merge pull request #1779 from keitwb/rhel-build-note (Ben Keith)
- EDM-2254: Fix directory drop in reference for db/kv (Dakota Crowder)
- Add doc on how to access downstream builds (#1774) (Ben Keith)
- NO-ISSUE: Various doc fixes (Frank A. Zdarsky)
- EDM-2043: Create SSH known_hosts file during installation (#1775) (Siddarth Royapally)
- EDM-2273: device/dependency: ensure stale images are removed on version change (Sam Batschelet)
- EDM-2271: Fix TPM Activate Credential with tracing disabled (#1763) (kkyrazis)
- EDM-2255: added flightctl-restore to the rpm (Asaf Ben Natan)
- EDM-2272: device/application/podman: ensure pods are cleaned up on removal (Sam Batschelet)
- EDM-2266: Append org id param to console requests from cli and address outdated const refs (Dakota Crowder)
- EDM-1870: automation of quadlets installation in RHEL9 vm (sserafin)
- NO-ISSUE: Update repo to rpm.flightctl.io (Frank A. Zdarsky)
- EDM-2254: fixed quadlets docs, added restore version option (Asaf Ben Natan)
- EDM-1183: Encapsulate template detection logic (Gal Elharar)
- EDM-2171: Update dry run script (Siddarth R)
- EDM-2043: bypass known_hosts check for skip verification (#1602) (Siddarth Royapally)
- EDM-2036: CLI Update Flightctl completion (#1601) (Siddarth Royapally)
- EDM-2211: docs: clarify bootc image building dep (Sam Batschelet)
- EDM-2248: Replace yq dep with jq/pyyaml (Dakota Crowder)
- EDM-2246: Ensure alertmanager-proxy tag is updated from :latest when installing rpm (Dakota Crowder)
- NO-ISSUE: agent: remove stop and unnecessary locking (Sam Batschelet)
- EDM-2088: docs: revert downgrade support (Sam Batschelet)
- EDM-2232: Explicitly set device fields unset by ApplyJSONPatch (Dakota Crowder)
- NO-ISSUE: fixed race condition when stop is called before start is finished on agent (Asaf Ben Natan)
- NO-ISSUE: create clean snap and verify snapshot revert (Asaf Ben Natan)
- EDM-2224: setting awaitingReconnect annotation on ERs based on renderedVersion parameter ( new parameter) (Asaf Ben Natan)
- EDM-2169: ERs marked when restoring (Asaf Ben Natan)
- EDM-1246: Add FIPS validator (Frank A. Zdarsky)
- NO-ISSUE: Fix mismatch in RPM version calculation across builds (#1729) (#1730) (Assaf Albo)
- NO-ISSUE: agent: clarify concurrency model (Sam Batschelet)
- EDM-959: Add documentation for device observability with Telemetry Gateway and otelcol (#1695) (Assaf Albo)
- EDM-552: support for cli format (Asaf Ben Natan)
- EDM-2228: Installation fails when using an external database with sslmode verify-ca (#1716) (Gregory Shilin)
- Bump tj-actions/changed-files from 44 to 46 in /.github/workflows (dependabot[bot])
- EDM-1183: Add comprehensive unit tests for template OCI image validation (Gal Elharar)
- EDM-1183: Enhance OCI image reference validation to support template parameters (Gal Elharar)
- EDM-1392: Remove test containerfiles (Gal Elharar)
- EDM-1392: Fix bootc linting issue with tmpfiles.d configuration (Gal Elharar)</changelog>
</package>
</otherdata>